Two or more network destinations for logstash-forwarer


(Alexander Mackushev) #1

I have two types of log files on my host: json formatted & plain text, and I want to send them to different logstash servers. I made 2 config files with different network options, but logstash-forwarer refuse second config with : "Could not load config file /etc/logstash-forwarder.d/logs.logstash-forwarder.conf: SSLCA already defined as '/etc/pki/logstash-forwarder/logstash-forwarder-dev.crt' in previous config file".
How can I have different network options for different group of files?


(Mark Walkom) #2

Use tags on the inputs with conditionals for those on the outputs.

https://www.elastic.co/guide/en/logstash/current/config-examples.html#using-conditionals


(Alexander Mackushev) #3

I can use conditional only at logstash side, but my problem is about forwarder.
The only attribute, I can add with logstash-forwarder, to use in condition is 'type'. I can route json & plain logs to one plain lumberjack input, but set 'special' type for all json logs. Than I can use decoding filter.
Not so pretty, but useful, thank you!

But is there way to route json logs to separate input ?


(Mark Walkom) #4

Ahh sorry, misread that :smile:
There's nothing you can do there unfortunately.


(system) #5